[SOLVED] Accessing internal IP via domain name from AP wifi router

Glinka · July 17, 2023, 1:15pm

I have a mix of wireless and wired clients, including a wired home server. Previously, I had a single router, a TP-Link Archer C7 running OpenWRT. I was able to access my server from the internet via port forwarding, and I also had NAT hairpin/loopback working configured. i.e. I could access my server via its domain name, from both from outside or inside my local network.

I have now set up a MikroTik RB5009UG+S+IN as my main router. This connects directly via ethernet to various computers including the home server. Our wifi is provided by a Synology RT2600ac, which is connected to the MikroTik, and set to access-point mode.

My home server is accessed externally through foo.bar.com. I have several rules on the MikroTik that forward http(s) traffic to the server (192.168.1.91). e.g.

/ip firewall nat
add action=dst-nat chain=dstnat dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=192.168.1.91 to-ports=80
add action=dst-nat chain=dstnat dst-port=443 in-interface-list=WAN protocol=tcp to-addresses=192.168.1.91 to-ports=443

I can access this domain name when connecting from outside the LAN. It also works well for clients within the LAN, but only when these are wired directly to the MikroTik router. If clients within the LAN connect via the Synology wifi router, I can no longer access the server via domain name.

If I ping from a wired client, it connects directly to the internal IP.

$ ping foo.bar.com
PING foo.bar.com (192.168.1.91) 56(84) bytes of data.
64 bytes from foo.bar.com (192.168.1.91): icmp_seq=1 ttl=64 time=0.255 ms

If I ping from a wireless client, it only sees the external IP.

$ ping foo.bar.com
PING foo.bar.com (<external IP>) 56(84) bytes of data.
64 bytes from <my ISP's domain name> (<external IP>): icmp_seq=1 ttl=64 time=3.96 ms

I can also ping the internal IP 192.168.1.91 directly from the wireless client.

The wired connection works fine even if I don’t explicity set up NAT hairpin/loopback. FWIW I tried setting it up anyway, but this did not help with the wifi clients. (I’m not even sure why the wired client works with my current setup, with pings going to the correct internal IP. I only have specific ports forwarded to the internal 192.168.1.91. Pings don’t have ports, so I don’t understand why this traffic is getting redirected to this address.)

I’ve checked the settings of the Synology wifi router, and there doesn’t seem to be anything there that is useful. In any case, since it’s in access-point mode, presumably the pertinent settings are in the MikroTik router. To confirm that the MikroTik router was probably what needed to be configured correctly (and not the Synology wifi router), I tested with my old Archer C7 that used to allow connecting to the server. I kept all the old settings, except set it to access-point mode, then connected it to the MikroTik router. When connecting to the Archer C7 SSID, NAT hairpin now did not work. This suggests to me that the problem lies with the main MikroTik router.

How can I access the server from the wireless LAN via its domain name?

wiseroute · July 19, 2023, 6:49am

hello,

$ ping foo.bar.com
PING foo.bar.com () 56(84) bytes of data.
64 bytes from <my ISP’s domain name> (): icmp_seq=1 ttl=64 time=3.96 ms

is that foo.bar.com dns domain hosted on the internet?

if yes, then you could make secondary dns server for lan user on MT :

with private address scope. and
add a dns server forwarder for regular internet access.
set your lan clients to use MT dns server.

you might want to read this guide

https://wiki.mikrotik.com/wiki/Manual:IP/DNS

hope this helps.

Glinka · July 19, 2023, 7:04am

Thanks @wiseroute. I’m not sure if this is what you are asking, but foo.bar.com directs to my external IP. This mapping is propagated to all DNS servers. Hence anyone can access my external IP via this domain.

I tested which DNS server from both wired and wireless clients use. Both of them are using the same DNS server via the router.

$ dig foo.bar.com
...
;; SERVER: 192.168.1.1#53(192.168.1.1) (UDP)

It doesn’t look like DNS is the problem.

wiseroute · July 19, 2023, 10:17am

hello glinka,

I’m not sure if this is what you are asking, but foo.bar.com directs to my external IP. This mapping is propagated to all DNS servers. Hence anyone can access my external IP via this domain.

ok… where did you hosted your foo.bar.domain?

did you rent this domain and host it on the internet? ie. you rent and hosted this domain from any web hosting site?

example:
you rent and manage your domain from google business etc. —> this for the internet dns view (for the internet to reach your natted server).

or

did you rent the domain from the internet and hosted it by yourself on your lan?

example:
you make a dedicated dns server on your lan which hosts your domain both for the internet and your lan?

from this output:

$ ping foo.bar.com
PING foo.bar.com () 56(84) bytes of data.
64 bytes from <my ISP’s domain name> (): icmp_seq=1 ttl=64 time=3.96 ms

it is indicated that your lan clients accessing your server via internet dns server lookup (which will only contains records with public ips).

for your lan to be able directly contact your local server - is to create another dns server for your domain for local use with private ip in it.

so… you will have 2 dns server for your domain:
1 for the internet to access your server via public ip.
2 for the local lan to access your server using local private address.

you can enable this dns server on dhcp server for your lan. and don’t forget to add dns forwarder for any other dns query (internet).

tested which DNS server from both wired and wireless clients use. Both of them are using the same DNS server via the router.

yes. but that’s the problem. your router doesn’t have any foo.bar.com record in it. so your dig commands returns nothing.

that MT wiki has a very detailed guide to start.

hope this helps.

Glinka · July 19, 2023, 12:15pm

Thanks again @wiseroute.

ok… where did you hosted your foo.bar.domain?

I use dynu.com to sort out the domain name. I then run ddclient on my home server to update the IP with dynu.com.

for your lan to be able directly contact your local server - is to create another dns server for your domain for local use with private ip in it.

Ahhh right, okay I think this makes sense.

yes. but that’s the problem. your router doesn’t have any foo.bar.com record in it. so your dig commands returns nothing.

The weird thing is that from the dig command, both wired and wireless client are apparently using the same DNS, at IP address of the gateway (router). So I don’t really understand why the wired clients can connect fine, but the wireless cannot. I would think that it would either work for both, or be broken for both. I’ll try the DNS server anyway, and see if that helps.

that MT wiki has a very detailed guide to start.

I had a look at the wiki page you linked above and created a static DNS entry with name=foo.bar.com and address=192.168.1.91. I also confirmed that this had been set by checking the DNS cache. However, this doesn’t seem to have fixed the problem, and the wifi clients still cannot connect.

wiseroute · July 19, 2023, 2:03pm

hello Glinka,

However, this doesn’t seem to have fixed the problem, and the wifi clients still cannot connect.

ok. let us see your MT dns settings,

and tell us how do configure your wifi clients ip settings. which device gives ip settings to your wifi clients? MT or your wifi box?

Glinka · July 21, 2023, 1:38pm

Hmmm… It looks like this has resolved itself somehow. I may have been the static IP setting that you suggested earlier… but it seems to have taken ~24 hours to resolve itself on my devices. I did try restarting them all, but for some reason it took a while. The other thing is that I changed IPs before it fixed itself, so that could be another difference?

For the record the Wifi router had the DNS server set as the main MikroTik router. I still don’t entirely understand why wired worked and wireless didn’t, but at least it works now!

Thanks for all your help wiseroute!